{
  "finding_id": "DF-2590",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "Confirmed on the verbatim driver in the DF-2386 kernel rig: acpi_panasonic_hkey_event discards the AcpiEvaluateObject status for HINF (acpi_panasonic.c:403) and dereferences res = buf.Pointer at :405; the driver sets buf.Pointer = NULL at :402 and ACPICA leaves it NULL on every failure path (nsxfeval.c:525-631). The rig captured the real verbatim acpi_panasonic_notify registered by the real attach and dispatched notify 0x80 exactly as ACPICA deferred dispatch would: happy path first (HINF integer 0x81 -> key decode, acpi_UserNotify fired, handler returned, no panic), then with the HINF evaluation failing the identical injection panicked the kernel 4/4 runs at Stopped at acpi_panasonic_notify+0x9f cmpl 0x1,(%rdi) -- that immediate (ACPI_TYPE_INTEGER == 1) fingerprints the res->Type != ACPI_TYPE_INTEGER test at :405 with %rdi = res = NULL (hkey_event inlined into notify), exactly as 0x4 fingerprinted :279 in DF-2386. The late if (buf.Pointer) AcpiOsFree at :420-421 proves the author knew the pointer can be NULL, one check too late. Trigger on hardware is an Fn-hotkey ACPI notify coinciding with an HINF evaluation failure (physical user + failing eval or hostile firmware) -- AC:H/UI:R as scored. NULL-deref panic, no write primitive, not a privesc. fix.diff (status check + res NULL guard) A/B validated: the identical armed injection makes the handler return cleanly with the guest staying up.",
  "exploit_chain": "ACPI notify 0x80 on the MAT0019 device (Fn hotkey press; rig injects it to the captured real handler from a kthread, mirroring ACPICA deferred dispatch) -> acpi_panasonic_notify case 0x80 -> ACPI_SERIAL_BEGIN -> acpi_panasonic_hkey_event -> AcpiEvaluateObject(HINF) fails leaving buf.Pointer NULL -> res->Type load from NULL -> fatal trap, kernel panic. Ceiling is DoS from a firmware-event context; no unprivileged syscall trigger, no write primitive, no uid0 path.",
  "evidence": "panic.txt (serial: login: PANASIM: worker: exec cmd=3 / PStopped at acpi_panasonic_notify+0x9f cmpl 0x1,(%rdi) / db>); run.log + run.2.log (happy path notify_seen=1 then armed trigger kills the ssh session -- Connection closed by remote host); run_fixed.log + rig ring (fixed: inject: dispatching -> eval HINF AE_NO_MEMORY -> inject: handler returned, guest up)",
  "kernel_refs": [
    "sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:401-405",
    "sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:420-421",
    "sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:486-492",
    "sys/contrib/dev/acpica/source/components/namespace/nsxfeval.c:530-566"
  ],
  "poc_changes": "No seed PoC existed; reused the DF-2386 rig and added the HINF reply mode knob plus notify injection: the interposed AcpiInstallNotifyHandler captures the verbatim acpi_panasonic_notify + softc context, and hw.panasim.cmd=3 dispatches notify 0x80 from a kthread (ACPICA dispatch model). Harness observations baked into the VERDICT: all console and msgbuf output originating from the injected-notify kthread is silently dropped by the console layer (both kprintf lines and the trap block; only DDB own print survives), so the full-format trap block of the sibling DF-2386 panic plus the 4/4 deterministic DDB stop line constitute the capture.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #4: Mon Oct 19 09:05:52 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/PANHARNESS  x86_64",
  "runtime_sec": 2400,
  "guest_dirty": 0,
  "build_cmd": "sh build.sh          # shared with DF-2386 (verbatim driver + rig, PANHARNESS kernel)",
  "run_cmd": "sh run.sh baseline    # create device, happy-path notify (hinf_mode=1), arm hw.panasim.hinf_mode=0, inject notify 0x80 (cmd=3) -> panic;  sh run.sh fixed",
  "code_hash": "a70387113f982a4e39cc0daf840d67df623a06cdbcd64a5b48c1ab3aafd39ac7",
  "notes": "Same NULL-Type class as DF-2386 (whose sinf half is also duplicated by DF-2589) but notify-reachable rather than sysctl-reachable; recommend folding with DF-2386 on triage per the pass-2 note for this file. Happy-path proof rules out a rig artifact: the identical injection with a conformant HINF integer completes through the whole verbatim notify path.",
  "recommended_fix": "acpi_panasonic_hkey_event: check the AcpiEvaluateObject status (device_printf + goto end on failure) and guard res == NULL before res->Type, matching the existing buf.Pointer guard at :420"
}